Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coding Horror: The PHP Singularity

codinghorror.com

Post reply on HN
Print view View original

281–290 of 341 posts

Re: Coding Horror: The PHP Singularity

#281

Post by padraicb »

skrebbel wrote: post #82
ars wrote: post #65

Earlier quoted context omitted.

> default to HTML escaping on output ??? Is that a joke? Don't do that! That's just as bad as magic quotes. > no register globals It hasn't existed for a quite a while now in PHP. Other than that I quite agree with what you wrote. Most of the criticism of PHP is simply a desire to be special. If lots of people are using something, you want to make sure not to, so that you feel special. Now that you've decided not to…

> > default to HTML escaping on output > ??? Is that a joke? Don't do that! That's just as bad as magic quotes. No, it's not. Magic quotes are a pain to reverse. HTML escaping can be built into the echo/print/ commands, so that it is: - A setting that can be totally turned off at run-time, if you want; - Easily overridden on a case-by-case basis with a 'rawecho' function that does *not* escape anything.

Problem with HTML escaping by default - it's not all HTML escaping. Javascript strings need to be JS escaped, sometimes escaped by HTML as a second (or even first) step to complete the correct encoding needed to avoid XSS for the specific context(s) that output actually ends up in for a browser. Same for CSS, URIs, vbscript, parameters, etc.

HTML escaping is not the one and only escaping strategy that magically makes everything safe. So any automated system would need to incorporate overrides on a per variable basis.

http://blog.astrumfutura.com/2012/06/automatic-output-escapi...

Re: Coding Horror: The PHP Singularity

#282

Post by harshreality »

ScottBurson wrote: post #244
cletus wrote: post #161

Earlier quoted context omitted.

That's easy: the best recognize languages are just a means to an end. Language snobbery, in my experience, tends to be highly correlated with being a "wannabe" rather than "great" and a useful filter. You will find any number of C/C++ programmers who think you can't write anything in Java. Many Java programmers think you can't write anything (beyond 100 lines) in Python. Many Python programmers think you can't (or si…

You have obviously never worked on a million-line codebase. When you have crap like this in your language: > E.g., $i = 0; $a[$i] = $i++; makes a different array than $i = 0; $a[$i + 0] = $i++; you have no hope of making a truly large program work. There are just too many sources of itsy bitsy bugs; you'll never find them all. (I'm not a PHP user; I have no idea why those are different arrays. Don't bother explaining…

I don't use PHP much, but I was curious, so here's the answer you don't want:

You get $a[1] = 0 the first way, and $a[0] = 0 the second way. PHP seems to evaluate the array index before the right hand side if there is something more than a $variable to evaluate; otherwise PHP evaluates the array index after the right hand side, after $i has been incremented.

I haven't used hiphop, but I'm curious if it preserves that disparity between arrays when translating to C++, or if it breaks PHP compatibility by making those two arrays equivalent.

Re: Coding Horror: The PHP Singularity

#284

Post by dxbydt »

chez17 wrote: post #274
kintamanimatt wrote: post #261

Earlier quoted context omitted.

Ruby. It's the cleanest language with the most sensible standard library I've come across to date. Ruby doesn't necessarily mean Rails, and in fact I'm not a fan of Rails' overly prescriptive paradigm. (As an aside, any time you hear Rails is an MVC framework, discount it because it's really an MVA framework.) One of the things you'll find coming from the world of PHP is Ruby has consistent method signatures. For thi…

Thank you for taking the time to write this. You have sufficiently peaked my interest. My next personal project will be done in Ruby.

>My next personal project will be done in Ruby.

Here's a better idea. Take a very simple problem - say user fubar enters his name, you say "Welcome, fubar!", populate a backend database with his name because he's a new user. Otherwise you tell him "Welcome back, fubar!" and don't mess with your database.

This involves what ? Handling a GET, making a database insert, doing a select on name in a database, that's it.

Now go do this in atleast 5 frameworks, and time yourself. PHP obviously, but do try RoR, Django, Play2, JSP and ASP.NET

I actually did the above exercise and came away with a lot of valuable insight. In my case Play2 was a breeze because on Heroku its trivial to set up, and each GET xxx request mapped directly to a xxx scala method in the Controller, so no magic. The others were a little more painful, but not a whole lot. I enjoyed the exercise.

Re: Coding Horror: The PHP Singularity

#285

Post by kreek »

kintamanimatt wrote: post #261
chez17 wrote: post #256

Earlier quoted context omitted.

Sorry to respond twice to your post, but I realized this was a great opportunity to learn something. Given my basic example in my post, what language would you recommend I try to accomplish this task? I like to stay away from frameworks so basically I'm asking you to not suggest Rails, however don't be afraid to suggest ruby. If you feel like typing something out, let me know why you suggest it and what advantages it…

Ruby. It's the cleanest language with the most sensible standard library I've come across to date. Ruby doesn't necessarily mean Rails, and in fact I'm not a fan of Rails' overly prescriptive paradigm. (As an aside, any time you hear Rails is an MVC framework, discount it because it's really an MVA framework.) One of the things you'll find coming from the world of PHP is Ruby has consistent method signatures. For thi…

I'll second Ruby because of Sinatra and add some of my own thoughts. Sinatra is a very gentle introduction to separation of concerns. You can get a Sinatra app running on a shared Dreamhost with the same effort as a PHP site.

PHP was ok for me I spent a ton of time looking up functions in the docs but I could get stuff done. Once I had to edit/work with 3rd party code it was a nightmare.

I've developed in PHP, Ruby, C#, Java, ActionScript, and Python and Ruby's gem system is by far the easiest package management system I've used. Making your own gem is really easy.

Great ideas seem to pop up in Ruby first and then are ported to PHP, so why not use the original (see Rails, Cucumber, Bundler).

Re: Coding Horror: The PHP Singularity

#287

Post by ars »

kaiuhl wrote: post #126
ars wrote: post #114

Earlier quoted context omitted.

If I make a string: ' ' . $var . ' ' - does it know to encode the variable, and not the entire string? What if I assign that string in a variable, and then output it later? I'm not convinced this can be done well. Maybe if all you do is make some templates and fill them in you could do it. But I do a lot more than that, I output dynamically built html all the time. Just give people a very easy and shortly named funct…

The hopefully obvious answer to your question is to not generate markup in PHP (or any server-side language). These are the kinds of questions that Backbone, Spine, Ember, etc attempts to solve. You should look toward separating view concerns from your business logic and stop procedurally generating html in PHP.

I separate my concerns just fine using PHP. Different files, not different languages.

PHP IS a templating language. Writing another one on top of it is just adding complexity for no gain.

Re: Coding Horror: The PHP Singularity

#288

Post by mikeash »

wvenable wrote: post #273
mikeash wrote: post #262

Earlier quoted context omitted.

Yes, JavaScript has the same string comparison problems as PHP. And it gets a ton of criticism for it. JS doesn't have all these other problems, though. For the unit tests, it looks like there are still 100 unexpected failures in the latest release: http://gcov.php.net/viewer.php?version=PHP_5_4&func=test... Am I misinterpreting that? Yes, no platform is free of security problems. But the way a security problem happe…

I actually clicked on several of those failed tests and there doesn't seem to be anything critical there. Looks like some access problems (test setup) and at least one needed the test to be updated. I'm not sure when these where run but it would be easy for someone went through all of them and give them a pass. A failed test doesn't necessarily mean that deployment should be held up. 700 failed tests is a different s…

The fact that the tests would be easy to fix makes it worse, no better. The problem the tests and the security hole was not that the tests indicated severe problems, but that all these simple failing tests masked the presence of a new, serious failure. If your test output is filled with junk due to failing tests because of minor bugs, it makes it much harder to notice when your tests uncover a major regression.

Re: Coding Horror: The PHP Singularity

#289

Post by ars »

eru wrote: post #125
ars wrote: post #114

Earlier quoted context omitted.

If I make a string: ' ' . $var . ' ' - does it know to encode the variable, and not the entire string? What if I assign that string in a variable, and then output it later? I'm not convinced this can be done well. Maybe if all you do is make some templates and fill them in you could do it. But I do a lot more than that, I output dynamically built html all the time. Just give people a very easy and shortly named funct…

Just needs a bit of type system magic. Don't use the same type for escaped and unespaced strings. (And don't use the same type for user generated input before and after it's scrubbed / escaped of any nastiness.) Ask any Haskell weeny for details. Also in your example, you'd probably be better of, if your language knew about the HTML structure, e.g. something like P($var), instead of putting the tags in as strings.

> Just needs a bit of type system magic.

I like this, although when you concatenate strings, does it actually concatenate them (and loose the type info)? Does it escape them, and then concatenate? Or does concatenation actually make a closure, which is only executed upon output? (And does doing that make things memory heavy.)

Haskell is on my next language to learn list.

> something like P($var)

Ugh. I hate that. I've spent years learning HTML, I want to write HTML, not some other language that looks like it.

Re: Coding Horror: The PHP Singularity

#290

Post by kintamanimatt »

dxbydt wrote: post #284
chez17 wrote: post #274

Earlier quoted context omitted.

Thank you for taking the time to write this. You have sufficiently peaked my interest. My next personal project will be done in Ruby.

>My next personal project will be done in Ruby. Here's a better idea. Take a very simple problem - say user fubar enters his name, you say "Welcome, fubar!", populate a backend database with his name because he's a new user. Otherwise you tell him "Welcome back, fubar!" and don't mess with your database. This involves what ? Handling a GET, making a database insert, doing a select on name in a database, that's it. No…

The only trouble with this is that trivial applications tend to only give a superficial feel for the framework and aren't representative of a "real" development experience. For example, I wrote a trivial application in Flask. Python's Flask, while it looks great on the surface and has fantastic documentation, rapidly becomes unwieldy in the face of more complex problems. The same is true for Ruby on Rails.

Most frameworks almost feel like they're tuned to solve these basic problems and give a fantastic first impression that doesn't sustain.

Developing a complete project in each is a better way to move forward IMHO.

Post reply on HN